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Five Notes on the Application of Proof Theory 
to Computer Science'*' 



Georg Kreisel 

Institute for Mathematical Studies in the Social Sciences 

Stanford University 



Introduction . Let me "begin with a manifesto. As will "be evident 
throughout these notes my "background is in proof theory, not in computer 
science. However — and this fact might easily confuse the reader--my in- 
terests here are almost diametrically opposite to those of most logicians 
who publish on computer science. There will be little general mathematics] 
and what there is, will always be subordinate to the applications, as I 
understand them. I realize quite well that professional computer scien- 
tists (that is, people paid by computer science departments or affluent 
firms) are often as much attracted by beautiful general: ties about compu- 
tation as my fellow logicians. Perhaps they can afford it because, through 
experience, they have developed judgment on the relevance of these gener- 
alities. Evidently I cannot hope to have this kind of judgment. Be that 
as it may, let me set out here theoretical reasons for the philosophy 
followed in these notes. 

We know of course that there is something common to proof theory 
and computer science: the formal rules studied in proof theory and the 
computation rules, both for numerical and non- numerical computation, studied 
in computer science are mechanical ; indeed, the basic 'gra.id' idea behind 
formalization was the mechanization of mathematical reasoning, long before 
an even approximate physical realization of this idea by electronic machines 
could be proposed. Turing's analysis of the notion of mechanical rule in 
terms of an (idealized) machine led to recursion theory , the mathematical 
theory of mechanical rules or, at least, of functions definable by such 

3 

rules. Consequently, general results 'about' mechanical rules will be 
applicable both to formal hules (in proof ■theory) and computational rules. 

In particular, this applies to well-known recursive, unsolvability results. 



Bui; no subject (except possibly some mathematics) lives on negative 
results. They indicate what not to do. This is the content of the 
slogans: Proof theory begins where recursion theory ends ; and similarly 
for computer science. More soberly, by picking out specific , ’narrow* 
subclasses from among all mechanical rules we shall find those that are 
relevant to proof theory and those (others) relevant to computer science. 
For example, in proof theory the significant results are about specif ic 
formal systems. The brutal well-known ones, so-called Frege-Hilbert 
style axiomatic systems, are picked out by the mathematical content of 
the so-called non-logical symbols in the axioms (relation, function 
symbols); the sophisticated ones, discovered by Gentzen and Prawitz, 
are picked out by an operational meaning assigned to the logical symbols. 
In computer science there are additional conditions on feasibility (com- 
plexity of programs, length of computation). It stands to reason that 
for those narrower classes of rules more significant positive results 
are possible. To use slightly hysterical language: if there simply 

aren’t general positive results (to be found for the class of all re- 
cursive functions), there just isn't a possibility of a 'deep' study 
of the general case* 

The other extreme — or, better, error — that has to be avoided is 
sometimes expressed by saying that ’computation is an art*. What is 
meant, in terms of the preceding paragraph, is that there are no rational 
or theoretical principles for choosing relevant c lasses of rules (formal 
systems, respectively computation rules). I believe that experience in 
proof theory may be of heuristic if indirect value here. The early hope 
in proof theory was that we could use a partial but very s imple criterion 
for choosing formal systems, namely, their completeness for the intended 
interpretation . For example, when Art in and Schreier produced their 
axioms for real closed fields (which seemed adequate for current algebra) 
thQir successful choice appeared like magic. Tarski’s discovery that 
these axioms produced precisely those (first order) statements which are 
true for the field of real numbers, gave a truly satisfactory explanation 
of the choice made by Artin and Schreier. (i do not know if Tarski em- 
phasized this aspect.) It is an explanation because each theorem of 
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current algebra was expected to be valid for the reals. Now Godel's 
incompleteness theorem shows that the simple criterion of completeness 
cannot be used for the choice of formal systems for arithmetic, analysis , 
set theory, etc. This does not at all mean that there is no principle 
of choice; only it will have to be subtler than mere completeness. Be- 
sides, even when, as in the case of first order classical predicate cal- 
culus, we have formal systems complete w.r.t. validity, there are many 
different axicmatioaticns (as already mentioned, completeness makes only 
a partial, in fact, rather brutal choice). The further choices needed, 
a.id made by fientzen or Prawitz, are just of a quite different order of 
sophistication. Also, the discovery of significant 'subsystems' of 
analysis in the literature is incomparably more sophisticated than, say, 
that of (complete) systems for dense orderings (I use the word 'subsystem' 
current in the literature; actually every formal system is a subsystem of 
the set of true statements if the' formal language contains arithmetic). 

Needless to say it is not claimed that the same considerations are 
relevant to the choices of both formal systems and computation rules . 

Quite simply: at least in the most articulate parts of proof theory the 

choices are made on epistemological grounds, that is, according to the 
kind of understanding needed to recognize the validity of principles 
(axioms or rules); the complexity of iterating these principles is rarely 
a principal object of research. In computer science the complexity is 
paramount. So one of the main problems will be to find the parts of 
proof theory that are useful to computer science. The particular exam- 
ples mentioned in the last paragraph are illustrations only; not only 

of difficulties (of finding formal rules and of judging the choice) but 

5 

also of solutions to these difficulties, at least in some cases. 

It should also be remembered that, quite apart from the philosophical 
aims mentioned, proof theory often looked for systems fairly close to our 
ordinary reasoning. This suggests a further reason why quite different 
principles of choice are needed, simply on the assumption that human 
reasoning (or, in crazy language, 'information processing by the brain') 
has a different structure from mechanical computers: for example, very 

mechanical instructions confuse the human computer. The practical effects 

O 
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of this simple observation are far reaching: The mere fact that we find 

it easy to solve some class of problems in, say, propositional calculus 
is no reason at all for supposing that they are easy for a computer; or, 
more formally, that there exists a short program. So it is not even easy 
to judge whether we are stupid when we are not able to mechanize reasoning 
which is easy for us. In fact, Section 4 contains proposals for studying 
such questions. The principle adopted is the simplest in the world: The 

single most surprising innovation of logical foundatio ns is the reductio n 
of our mathematical vocabulary : Does t his destroy the practical possibility 

of reasoning ? 

Finally, a word on terminology. I shall not use the jargon of com- 
puter science (and shall try to avoid most proof theoretic jargon, except 
in the title of Section 3 which uses both). First of all, I don’t Inow 
it well enough- -Fremdworter sind Glucksache . Secondly, perhaps in order 
to compensate for the 'inhumanly' systematic character of computer lan- 
guages, computer jargon is full of quite different words for distinct, 
but closely related ideas, like compiler and translator. I should prefer 
a civilized language with a word for the common idea (translator) and 
adjectives to qualify it.^ Thirdly, soma terms suggest, it seems to me, 
a sensational but ill considered aim, for example, 'theorem proving'. 

(For those who know the catechism, an outward and visible sign of an inward 
and invisible disgrace.) I shall use 'non-num.erical computing' or the name 
of the particular area where I believe such computing to be appropriate, 
for example, in the currently active subject of mechanical checking of 
programs (Section 2). Evidently there is nothing sensational in the idea 
of a 'mere' checking of a computer program, much less so than in checking 
mathematical proofs which are prirna facie (and probably intrinsically) 
non-mechanical. But, by being less sensational the idea is perhaps also 
more feasible. 
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I. Basic Notions and Distinctions 



NB. According to temperament the reader can either glance through 
this note before reading the others or simply go back to if when one of the 
basic notions or distinctions is actually needed. 

I shall consider here principally (computation and proof theory in 
connection with) arithmetic problems , and discuss afterwards modifications 
needed in other contexts. Since we have 2000 years of experience in nu- 
merical computation it should be easy to judge whether our general considera- 
tions are truly applicable (and not only aesthetically or theoretically 
pleasing) . 

1. General orientation . To describe the relation between the aims 
of computer science and proof theory briefly , one can use the slogans: 

Theory (or principles) of formalist mathematics 
versus 

Formalist theory (or reduction) of mathematics. 

Computer science has as its objects (formal) calculations and tries to 
develop a theory of these objects. The intended meaning of, say, an 
equation a = b _is that the formal objects a and b have been or can be 
reduced, by given formal rules, to the same term (their formal value). 

In contrast, proof theory, as originally understood, tries to establish 
that, for a different (mathematical) meaning of the formula a = b, 

a = b is true for that meaning if (and, possibly, only if) 
a and b have the same value . 

Example . Suppose we are given the formal rules for addition in. arithmetic, 
with the symbol 0 and the successor symbol s: a + 0 — > a, a + sb — »s(a + b). 

Then 0+s0=(s0)-t-0 means that each side can be reduced to the same 
term, namely sO (by using the second and first rule resp.). 

The expressions a + b and b + a with variables a and b can 

evidently not be reduced to the same term by means of the rules above. 

7 

Suppose, however, we interpret 

(*) a + b = b + a 
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to mean: for each pair of numerical terms (0, sO, ssO, . . . ) n and m, 

n + m and m + n have the same formal value for the rules of addition 
above. Then,, for example by the well-known Presburger-algorithm, there 
are formal rules generating all equations which are true about computa- 
tions (in the sense above); but it is not enough to use the axioms: 
a + 0 = a, a+sb= s(a + b) ’corresponding’ to the rules of addition. 

In the modern proof theoretic literature (for example, under the 
slogan operative Logik or operational logic) there is a great deal of 
material which is not directly relevant to the original aims of proof 
theory, but rather provides a theory of formal rules ; it extends the 
interpretation (*) of equations to logically complicated formulae • The 
theory does not deal with special properties of computation rules actually 
used in., say, arithmetic,, but with general Post - rules . (Evidently, the 
rules for numerical addition are set out as Post rules.) 

rjij^ig theory is coherent and has great aesthetic appeal. I have no 
idea of its usefulness to computer science, simply because it is not clear 
whether c omputat ionally interesting properties of (computation) rules are 
expres sed by the logically complicated f ormulae used (in contrast to 
commutativity in the example above, a property of addition which we use 
all the time, e.g., -when checking the addition of columns in different 
order) . 

The theory is often presented, particularly by Curry, in connection 
with a formalist reduction of mathematics. As a result it is usually 
(i) not taken seriously by those who find such a reduction implausible 
(though the theory is not at all needed for such a reduction) and (ii) 
not examined for its interest qua theory of formal rules (though, if it 
has such an interest, this would be independent of formalist doctrine; 
after all, s ome mathematics we do, unquestionably has formalist character, 
for example, computing). Some defects of the notions used in that theory 
will be apparent from the next paragraph. 

2. Computations. Anyone who has read this far, has no doubt a pretty 
good idea of what a computation rule or computation diagram is (for terms 
in some language L, the diagram takes the form O -» t /, 1 < i < N, 

t ± containing ’meta' variables). There are a relatively small number 



of useful notions about and, consequently, distinction s between various 
kinds of computation diagrams which are scattered in the literature and 
perhaps not even explicit. 

(a) Numerical and non - numerical computation (of numerical valued 
terms) or: the choice of computation diagram. In computations we normally 

use well defined functions and rules which give a numerical value s that is,, 
a value 0, sO, ssO, . .., or,, more usually,, a value in decimal or binary 
notation. In short there is a standard or normal form. This fact is used 
a good deal in the theoretical literature. 

It should be noted that the use of normal forms is, in practice if 
not in theory, in conflict with the practical requirement that answers to 
(numerical) problems must be comprehensible . Thus while 



io 1000 

_ . m 1000 

or even: the largest prime < 10 

are comprehensible answers^ neither of the standard representations above 
would do . 

More, formally^ practical computation diagrams f for* the exponent ial 
function or for the so-called bounded least number operator (used in the 
two examples above) must not permit further reduction; in other words^ 
though normal forms exist they must not be used* But it seems difficult 
at this stage to be much more specific about an efficient choice of normal 
forms; cf. also III §2c and III §3a„ The reader should note that the choice 
of language^ stressed throughout these notes in connection with proofs 
(•automatic theorem proving 1 )^ is also significant for computation,. 

Technical remark * If one wants to^ one can easily state some pre- 
cise * general* theorems here* Given any of the usual codes for partial 
recursive functions^ we consider non- numerical terms^, built up from these 
codes, for computing numbers (for "functions' with zero arguments! )| for 
example, by use of Kleene ' s bracket notation. In this way every recursive 
function f jis represented by a rudimentary function from numerals n 
(not to numerals but) to codes of the value of f(n). However, there 



is no evidence that this particular general scheme of using non- numerical 

g 

terms is also efficient. 



(b) Consistency of computation rules w.r.t. (a congruence relation 

between) normal forms . For any term t, if t can be reduced to the 
normal (irreducible) terms t 1 and 1 2 then and t 2 must be 

congruent . 

Examples. One familiar class of examples comes from computation rules 
which are (i) valid for, say, an arithmetic interpretation, that is, there 
are functions which satisfy the given rules in the sense of footnote 7 
and (ii) non-congruent normal terms denote distinct objects in the inter- 
pretation. Outside arithmetic, a well-known example is provided by combina- 
tory logic. (This may be relevant to computer science because Curry’s 
explicit intention was to analyze the basic steps in human mathematical 
reasoning in terms of combinatbrs . . Even if this intention is absurd, 
the possibility remains that this analysis applies to formal operations 

9 

which Curry assumed to constitute mathematical reasoning. ) 

Warning . In the light of (a), consistency (in the present and 
current sensei) is not a necessary condition for a computationally ade- 
quate diagram. 

(c) C omput ab i 1 i t y and strong computability (w.r.t. the notion of 
normal, that is, irreducible form determined by the computation diagram 
itself). Some, resp. every sequence of applications of the computation 
rules to any term t stops after a finite number of steps j that is, 
it reaches a term to which no further reduction can be applied. 

Evidently, rules can be perfectly valid in the sense of b(i) without 
possessing even the (weak) computability propertyj for example, in case 
of addition, we may have added, ’by. mistake 1 : a — » a + 0. 

(d) Hilbert - Post completeness (of the congruence relation’ between 
normal forms). If, for two non-congruent normal terms t^ and t„, 
the rules t^ — > and t 2 — > t^ are added to the computation diagram 
then all terms become interreducible . 

This is a specialization of the traditional notion of Hilbert-Post 
completeness for arbitrary formal systems: if a non-derivable formula 

is added to the formal rules then all formulae become derivable. (in 
the case of computation rules the only relevant formulae are equations.) 




Discussion . The idea "behind the Hilbert-Post notion is this: - to 
establish maximal it y of the rules considered with, a minimum of assump - 
tions about the intended meaning (or, as formalists like to say, 'uses') 
of the formal rules . As is well known, most familiar H-P complete sys- 
tems satisfy--like classical propositional calculus--the abstractly 
stronger conditions: For each formula F there is a substitution instance 

F 1 for which either F or F 1 is derivable. Also, quite often, we 
simply know enough about the intended meaning, e.g., of classical predi- 
cate (or, for that matter, propositional!) calculus to know that we have 
enough formal rules even if they are (or were) not H-P complete. Simi- 
larly, in view of (a), we shall not, in general, expect computation dia- 
grams to be H-P ccmplete j_f we have chosen them after careful analysis of 
practical requirements . 

5. (Formal) deductions . Once again (as in §2), the reader may be 
assumed to know what a formal system or, equivalently, a system of deduc- 
tion rules is."*"^ As in §2, we may distinguish between the problems con- 
nected with (analyzing) given formal systems and with choosing formal 
systems; cf. §2a concerning the choice of computation rules and even of 
the concept of normal form. So much is clear. 

Now there is a further element of choice, namely, the choice in the 
order of applying (computation and deduction) rules . Certainly not all 
computation rules need be deterministic; if we want to compute 0*t, 
for a complex term t, we may either first work out the numerical value 
of t and apply the recursion rules for multiplication or we may apply 
the rule 0»a -» 0 (if the latter is included; the recursion rules will 
always be included) . Again, if we have a rule for computing a function of 
two arguments there is a choice in the order in which the arguments are 
treated. But it may be expected that within such a well - organized frame - 
work as a system of c amputation rules, this : freedom of choice causes little 
havoc . In contrast, as we know from experience in mathematics, being given 
formal deduction rules is of little help. (in the analyses below of the 
'help* involved the lettering of subsections does not correspond to §2.) 

(a) Looking at deductions and searching for deductions (in a given 
formal system). Without wishing to be 'mathematical' in an affected sort 



of way, I'll begin by setting out the distinction in the form of two 
kinds of computation diagrams. 

Evidently, since operations on deductions are involved, the objects 
or 'terms* of the computation diagram will be (whole) deductions, not, 
say, derived formulae. 

Case 1 (the familiar set-up). This is relevant to a search for 
deductions. We start with: d -» d ' if (the deduction figure) d' is 

obtained from d by adding a formula which is an immediate consequence 
of formulae in d; 'immediate* by application of the given rules. 

There is no end to this procedure, and an independent criterion has 
to be added to create a semblance of a computation diagram with its ir- 
reducible or normal forms. What is indeed implicit in our ordinary way 
of thinking is that we wish to decide some formula A: Writing , 

we add the restriction d j * d * only if d -» d ' and d contains neither 
the formula A nor the formula — iA (because in either case the search 
is over ) . 

Note that the questions of §2a in connection with a choice of ir- 
reducible forms have a parallel here. Specifically, d need not con- 
tain the formula A itself but say a formula A 7 which is propositionally 
equivalent to A. This induces a congruence relation between 'normal' 
forms, that is, derivations containing A * or (— |A) # . The concepts of 
§2(b)-(d), with 'computability' replaced by 'formal decidability (of A)', 
are self-explanatory. What makes formal rules of 'little help' is that 
for the usual formal rules (with modus ponens and without 'strategies', 
that is, additional rules of choice) we do not have strong c omputab ility . 
This is a good negative criterion; but of course strong computability is 
not enough practically if the execution of the computation is not prac- 
tical. 

Case 2 (the sophisticated set-up). This is relevant to the analysis 
of (given) deductions. According to previous training the reader may 
think here of cut - elimination or elimination of redundancies where, in 
aptly-named natural deductions, an introduction (of a logical operation) 
is followed immediately by its elimination. In both cases we shall speak 
of a normal ization step . The computation diagram runs as follows: 
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a -> d ' if a ' is obtained from d by applying a single reduction 

step. 

Now, in contrast to Case 1, d can be irreducible, namely, if it 
is in normal form. Note here, for the normalization steps mentioned, 
d and d ' aut omatically have the same end formula. The concepts of 
§2(b)-(d) distinguish between different normalization procedures . For 
example, it is open whether, in familiar systems, cut-elimination rules 
are strongly computable, even when the allegedly 'equivalent* natural 
deduction rules are.^’^’ Naturally the terminology, e.g., of 'consistency* 
in §Zb, is meaningful only if the choice of the normalization procedures 
themselves is intended to respect some preassigned meaning of the normal 
deductions. The terminology is justified if non- congruent deductions are 
intended to express different proofs (in the ordinary sense of ’difference 
of proof' as used, e.g., in arguments about plagiarism) and normalization 
steps are supposed to preserve identity of proofs. 

(b) Conflicting requirements . Quite naively, it would be surprising 
that the same criterion, for example, the selection of normal derivation, 
should be useful for both the analysis of given deductions and for the 
discovery of new deductions of some given formula. Perhaps one should not 
ignore the ridiculous- sounding advice of mathematicians .(who- are,, .after a.11, 
well known to be terribly inarticulate outside their own domain) such as: 
one must not be too logical in research . As in footnote 4 of the intro- 
duction, precise and merely logically satisfactory formulations- may be 
much worse than no formulation at all because their defect is likely to 
be not obvious irrelevance but something subtler. 

Example . In the discussion of Case 1 in (a) above, failure of 

strong computability of the usual formal rules was mentioned; they are 

wildly indeterminate. On the other hand, normal derivation rules or the 

rules introduced by Herbrand are essentially deterministic: a formula 

determines very closely from which premise it must be deduced if it has 

a normal derivation at all. But as already mentioned, this is no reason 

at all for supposing that normal derivation rules (which were introduced 

12 

for the analysis of given proofs) should also provide efficient deter- 
ministic search procedures. 
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The practical conclusion which I'have drawn' from this observation 
and which I apply in Notes 2 and 5 is to look for areas where the analysis 
of given deductions is relevant . 

(c) Digression on search procedures (to be taken up in Note 4). The 
immediate purpose of this digression is to serve as a kind of mental 
hygiene . There is a natural; quite traditional aim,, to find a theory of 
mathematical reasoning. Through formalization it is possible to restrict 
this (evidently hopelessly) general aim to., say, reasoning within some 
limited context such as predicate logic. In addition we have some iso- 
lated quite striking examples. For example ; the logical theorems at the 
beginning of Principia fall into simple decidable classes for which,, as 
observed by Wang; there is a quite effective mechanization. True } these 
theorems do not at all have the look of typical mathematical theorems. 

But as long as no alternatives are set out; there is a lurking doubt: 
Shouldn 1 t something similar be p ossible for much wider and more interesting 
areas ? It may well be objected that; even if; objectively; such a possi- 
bility exists,, this is no good reason why any particular person should 
pursue it; he may not have the necessary talent or he may have more talent 
in another area. But it seems to me reasonable to present some alternative 
which could remove the doubts without the appeal to self-analysis made 
above . 

We are able to prove or refute quite a large number of formulae F 
in predicate logic with great ease. Often we are not aware of having fol- 
lowed a method. 

The lurking doubt is: 

There ought to be a mechanical method; applicable to a large class 
C of formulae of predicate logic; which will also decide the formulae in 
F in a reasonable time (where the greater speed of electronic computers 
is to make up for the subroutines supposedly stored by the human computer). 
Usually one mak es the additional' assumption that the class C is charac- 
terized by such syntactic conditions as prefix complexity or the number of 
arguments of the relation symbols used. 

Proposal . Granted that; in simple cases 5 we are not aware of follow- 
ing a method; let’s look at the nature of the methods which are used when 



The very first method that strikes one when inspecting the facts is 
the extension of the language. (indeed;, no inspection is needed, because 
the principal step taken in the formalization of ordinary intelligible 
reasoning was a reduction of the language]) Here we have two quite dif- 
ferent applications, which are both logically insignificant, but in dif- 
ferent senses, as made precise below. 

Definitional extensions . We consider consequences from axioms (X s , 
say for real closed fields. We extend the language by a binary relation 
symbol 0 (to stand for 'order') and derive a number of implications of 
the form Aq -» where A Q are axioms for an ordering. We make the 
definitional extension 

VxVy[0(x,y) ^ 3s (y = x + z 2 )] 



and derive from 



the formula A, 



Each B n is then, demonstrably 



'O’ 0 

equivalent (on the basis of (A)) to a formula in the language of fields. 

These extensions are logically insignificant in the sense that (not 
only in the present case, but under very general conditions) the introduc- 
tion of the symbols can be eliminated. But: at what cost ? for example, 
in length of derivation? The example is by no means farfetched: it is 

simply the formal counterpart to saying that our proofs are guided by 

2 

the meaning of the relation 3z(y = x + z ). Amusingly, electronic com- 
puters furnish an excellent means for answering this question of cost] 

Cf. Note 

Intr oduc ing abstract concepts (in the sense of higher type or set 
theory). We can use the language of the previous example, and consider 
ordered fields, i.e., the axioms Aq and the axioms for fields (among 
<£). To derive B^ we may proceed as follows. We use the fact that 
every ordered (ground) field has a real closure. This is a set theoretic 
statement. We can now apply set theoretic constructions to this real 
closure and then deduce results about the ground field. As a quite trivial 
illustration consider ‘a sirnplq formula of predicate logic. Writing 
< for 0 and p for the general polynomial of degree n. 

/A 



A< 



Vx 1 ...Vx n+1 ([ /A (x ± < x ±+1 A px..px i+1 < 0)] -»0 < px^px^) 
l<i<n 



A set theoretic proof proceeds by embedding the ground field in its 
real closure where px i *Px i+1 < 0 -» 3z (x i < z < x i+1 A pz = 0) and 



using the fact that a polynomial of degree n has at most n zeros. 

In contrast to the first example, the present use of set theoretic 



for the quite special reason that first order predicate calculus is 
complete. Of course the theorem above has also a first order proof, 
in fact a quite simple one. We need only use Lagrange's formula 



has different signs when k = i and when k = i + 1. But it is a 
subject for research to see whether in general the use of set theoretic 
methods is decisive for feasibility , that is, for effective execution in 
ti m e and space by an electronic computer or for intelligibility by a 
human one. (I have in mind mathematically or logically intelligible 
theorems, not the kind of ad hoc formulae usually constructed in the 
literature on 'speed-up'.) 

Preview . As the reader will see, only Notes 2 and 3 contain genuine 
applications of proof theory. Both analyze given deductions, illustrating 
the two important directions in proof theory, the methods of normalization 
and interpretation resp. In Note 4 we experiment on search procedures, 
using facts from proof theory merely as a guide for the design of 
experiments . 



concepts is logically insignificant (in the sense of being eliminable) 




and observe that 




II. Checking of Computer Programs ; An Example 
of Hon- numer i c al Computation 



We shall consider principally,, hut not exclusively,, programs for 
solving some arithmetic problem with a parameter^ n say. In terms of 
I §2(c) and I §3(a),, the formal counterpart to the informal distinction 
between checking and proving (the validity of)' a program is this: 

Checking a program is a decidable procedure^ by use of strongly 
computable rules; a check provides indeed a proof , by very elementary 
rules,, of 

(*) the function defined by the program solves the problem for all n. 

In contrast,, for the usual formal rules of inference^ it is not (recursively) 
deci dab le whether or not a universal statement of the form (*) is de- 
rivable . This corresponds to the meaning of 'checking' as a procedure 
which does not require ingenuity (in contrast to 'cross checking' which 
does., but which need not constitute a complete check). 

It will be best to begin with a closer look at the familiar ideas 
of 'arithmetic problem’ and 'solution ' 3 including the choice of language 
used to present the solution” cf. I § 2(a). The reader should not forget 
for one moment that,, in the context of checking^ the program ' and our 
knowledge of its properties are the principal objects of study!; we are 
not merely concerned with the sequence of states of the machine which 
the program^ objectively., determines; and a fortiori , not merely with 
the graph of the function which the ma, chine puts out; cf. footnote 3 
of the Introduction. 

1. numerical analysis and pro gr ammat ion . The general form of an 
arithmetic problem (which we consider here) is 

HmA(n^m) with parameter n } 

where the relation A may be defined by use of quite abstract concepts; 
for example., it may say that m is (a code for) an approximation,, to 
accuracy l/n, to the solution,, at the origin say,, of seme differential 
equation in Hilbert space. 

numerical analysis ,, by use of proofs not merely by mechanical checking,, 
provides more or less explicit solutions in terms of a function f (of n) 




iffy 
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determined in familiar terms,, for example,, 2 n or [log n] (the integral 
part of log n) . One sometimes says that numerical analysis provides an 
algorithm ; but, strictly speaking, the algorithm is only tacitly under- 
stood because in numerical estimates not the procedure of calculation but 
only the values of the function are relevant . In fact, numerical analysis 
provides in general not an algorithm but rather a simple functional equa - 
tion for f. .-which suggests an algorithm, e.g., in the case of 2 n 

Vp[f(0) = 1 A f(p + 1) = 2f (p) ] . 

Numerical analysis has done its job when it finds such a functional property 
or equation $(f) and a proof of 

§(f) -»A(n,fn) . 



(in §3c below we give some formal conditions ensuring that $ does 
determine an algorithm. ) 

Frogr animation consists in making explicit, in mechanical terms, the 
algorithm 'suggested' by the property §. Roughly speaking, checking 
a proposed program ^ consists in establishing by the elementary methods 
implicit in the idea of checking that rr f satisfies §. Our problem 
here consists in making explicit -what these elementary methods are. This 
involves of course some general conjecture on the type of properties $ 
which occur in practice (but not on the type of relation A!). 

The following example does not merely illustrate the difference 
between numerical analysis and programmation, but gives a good idea of 
the qualitative difference between a recursive and a feasible solution, 
discussed at length at the end of Note 1. 

Instead of the single variable n, we consider the quadruples 
n^, n^, n^ and n ? and the relation 



( O 2+n ' . 2+n ' 

(m = 0 & n + n 0 



2+n* v 

= n, ) 



V (m = 1 & 



2+n' 



2+n’ 



2+n* 



Without numerical analysis, we have the obvious program of 
evaluating' 



n. 



2+n' 



+ n. 



2+n' 



and n 



2+n' 



' s imply 
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for given positive integers n n 2 , n-^ and n' and ‘comparing’ them. 
The program must translate these instructions to the machine. With 
numerical analysis, that is a (partial or complete) proof of Fermat's 
conjecture, we should use a totally different program (for the same 
function of n^, n^, n^, n'J), namely 



n x , n 2 , ny n' 



13 



Amusingly, on the "basis of current knowledge, as far as existing com- 
puting machinery is concerned, only the second program is feasible (for 

numerical computing): for those numbers for which Fermat's conjecture 

. . . „ , 2+n f 2+n' , 2+n' 

is open at least one of the numbers n 1 , n 2 and n^ is so 

large that it could not be stored in any machine’s memory at allJ A 

much more sophisticated example will be given in XV §2b. 

2. Formalization of the concept of ' checking 1 : definitional 

equality (brutal approach). To start with, I want to convey an idea 
for such a formalization which a programmer, relying on his judgment and 
experience, may occasionally decide to use. It is evident that any appli- 
cation will depend on the pr ogramming language , that is, what precisely 
the symbol tt stands for in §1, and the possibly non - numerical terms 
(cf. I §2a) chosen to present the (numerical valued) solution in the 
particular application. I should try to refer the formalization to 
theories of programming languages or of (non-numerical) notation systems 
for natural numbers if I were convinced that any known theory is even 
remotely correct. As it is, the chanpe of introducing a systematic 
error by relying on current theories seems more damaging than the vague - 
ness which results from giving . only- an illustration (as I do below) , 

In the next section I shall try to discuss limitations. 

Proposal . Assume that the critical properties $ of §1 supplied 
by numerical analysis are conjunctions of equations t . = t^ (l < i < N) 
between terms built up from jF, the numerical variable p, and signs 
for specific programs (constants, successor operation, addition, multi- 
plication, etc.). Assume further that, for any program and any term 

t[rr] built up from n f j> P and the signs for specific programs (as 
above), a program is assigned to t [ tt3 • 



Then we define: 



TT^, is checked for § if for each i, 1 < i < N, the 

same programs are assigned to t^[rr] and t^[TT]° 

The question whether or not the same program is assigned to two terms is 
supposed to be decidable , and this constitutes the elementary character 
of 'checking 1 . 

Remark . It is familiar from recursion theory that for quite 
elementary formal systems , specifically any consistent r.e. extension 
of formal primitive arithmetic PRA, it is not decidable whether an equation 
between two terms containing a variable (p) is formally provable since 
the sets 

(t ,t_ : l- t = t_} and [t ,t p : Un |- t [p/n] ^t [p/n]) 

PRA PRA 

are recursively inseparable. (Here n ranges over numerical terms and 
t[p/n] is the result of substituting n for the variable p in t. ) 

I1 1 ustrations . Probably the reader understands the proposal pretty 
well, that is, the ideas of: program assigned to a term, and identity 

criteria for programs or, equivalently, definitional equality between 
terms. For deepening his understanding he should look at the relevant 
literature cited in footnote 9 of Note 1. Finally, since in terms of 
I §3a we are looking here at genuine, terminating programs only, perhaps 
an even better illustration of (or approximation to) proposed applications 
would be got from a language in which every term denotes a terminating 
program, as is the case with typed combinatorsq for arithmetic problems 
one adds (typed) recursion operators Whatever their mathematical appeal 

(or use in other contexts) the usual combinators do not seem to present 
any advantages here; specifically the definability <of an (even) type free 
recursion operator does not seem worth the price of introducing expres- 
sions for which one does not know whether or not the corresponding program 
terminates. And--perhaps this is a principal point- -it cannot be assumed 
that the BASIC IDEA OF THE WHOLE PROPOSAL (which comes from the familiar 
experience of knowing whether or not two familiar definitions denote the 
same program) EXTENDS UNAMBIGUOUSLY TO THE UNFAMILIAR (full) LANGUAGE 
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of combinators. So without any prejudice against future theoretical 
studies on this point,, I suggest that the reader concentrate on strongly 
computable computation diagrams in the sense of I §2(c). 

Example . We suppose descriptions of programs to he given by terms 
built up frcm typed combinators (of type: 0 -»0); cf. footnote 9 of 

Wote 1. Two such terms denote the same program if and only if their 
(unique) normal forms are congruent , that is, the normal forms are 
canonical or standard descriptions of programs. Since each term has a 
normal form, the required decision can be carried out by working out the 
normal forms . 

Corollary (to footnote 12 of Note l). For practically efficient 
solutions it will be necessary to find (sub) classes of terms for which 
an equivalent but computationally simpler criterion of definitional 
equality can be given. Naturally, as in footnote l4 above, the equivalence 
proof need not at all be elementary. 

3. Discussion of the formalization (proposed in the last section). 

(a) At first sight the sense of checking seems to be unduly narrow. In 
fact, a program tt- is, of course, a perfectly good solution even if 
rr^ does not check §, but simply satisfies §. The justification for 
the narrow definition, though simple, is often overlooked. 

If, as a matter of empirical fact, programmers tend to 
write programs which do check the conditions discovered 
by numerical analysis, it makes good practical sense to 
exploit this fact. 

In this sense the proposal involves an (empirical) hypothesis about 
programmers which has to be verified. 

(b) Note, however, that the notion of definitional equality(on which 
the formalization is based) is rather wide unless we are planning to use 
the program for a large number of values of p. It ignores the steps 
needed to go from the description t[rr] to its normal form, that is, 
to the program described, or, equivalently, to its canonical description . 

It is of course conceivable that an even sharper notion of checking is 
valid which is based on a narrower notion of definitional equality; 





'valid* in the practical sense above of being respected by actual program- 
mers. The discovery of such a notion would probably be at least as use- 
ful as the kind of mathematical discovery considered in the Corollary at 
the end of §2. 

(c) Concerning the general hypothesis on the form of functional 
properties $ supplied by numerical analysis (according to §l), one 
can distinguish three kinds. 

(i) The equations, read from left to right, translate into strongly 
computable computation rules; this is the case in the example given: 
f(0) -»1, f(p + l) ->2f(p) (when supplemented by rul.es for doubling: 

2.0 -»0, 2(p+l) ->(((2p) + 1) + 1)). 

(ii) §, that is, Vp§Q(p,f) provides a finite^ definition of f, 
that is; Ym3n3q( [ (Vp < q)§Q(Pjf )] -» fm = n). 

In this case f is recursive but the equations in do not necessarily 

provide a computation diagram. 

(iii) Conceivably numerical analysis provides a § that defines f 
uniquely but not computationally, for example, 

Vp[f(p) = 2f(p + 1)] . 

Only f = 6, i.e„, Vp[f(p) = 0] can satisfy this condition since if 
f(p) = k, f(p + k) = k*2 -which is not integral. But, presumably, 

the numerical analyst will himself provide this little argument and thereby 
replace the condition by 

Vp[f(p) = 0) . 

(d) Concerning the existence of genuine uses of the present proposal 
there can, of course, be no doubt inasmuch as I was able to appeal to 
such familiar material as exponentiation or doubling (only the range 

of application is in doubt). For the same reason the weakest point in 
the illustration is the use of mathematically 'interesting' and therefore 
unfamiliar material, such as the typed ccmbinators with recursion. No 
doubt more experienced people would be better able to judge at the present 
stage. 1 
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III. Consistency Proofs and Programs for Translators 



The kind of 'translator' meant here is supposed to start from a 
(formal) language relatively close to actual reasoning in arithmetic 
practice and to go over to computer programs. As a matter of empirical 
fact, actual reasoning uses non- constructive principles; as is well known 
the relation between non-constructive proofs and 'corresponding' programs 
is problematic. Roughly speaking, consistency proofs and their develop- 
ments solve these problems; in fact, this kind of use of consistency 
proofs is often considered to constitute their mathematical significance . 

Since the mathematics involved has been developed actively over half 
a century, it will be possible to be quite brief by referring 1 to the 
literature. The main point of interest is to indicate in what respects 
the existence of fast computers offers new (practical) uses for some of 
the existing consistency proofs, or makes developments desirable which 
would have no value to the human computer. 

1. Generalities . (a) To avoid confusion when reading the literature 
the point marie already in the introduction must not be forgotten: the 

official purpose of consistency proofs (formulated by Hilbert for philo- 
sophical reasons) is not only irrelevant to computer science but contrary 
to computer interests; cf. also footnote 1^ of Note 2. Hilbert's aim was 
to show, by elementary metamathematical methods, that if a universal 
statement *VxA (with primitive recursive A) is non-constructively 
provable then (*) each numerical instance can be checked by computation. 

But for the computer it is quite sufficient to know the fact (*); he 
gains nothing from knowing an elementary proof. The fact alone permits 
him to add an additional computation rule , namely, the subroutine: when- 

ever A[x/n], for numerical n, is supposed to be worked out (by computa- 
tion) the additional rule says: write 'true'. From the illustration in 

II §2 in connection with Fermat's conjecture, it is clear that a computer 
scientist (that is, numerical analyst) who knows only elementary constructive 
methods of proof is liable to be at a disadvantage here: he could not justify 
the use of this subroutine which can greatly shorten the work; more pedan- 
tically, which shortens the work whenever computations of A[x/n] 
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are 



needed for many n and we have a non- cons true tive, hut no elementary 

proof of VxA. . The 'constructivist' could, at best, make the empirical 

17 

prediction that the subroutine will 'work' . 

(b) In point of fact, most of the metamathematical studies which are 
described as 'consistency proofs' establish more. For arithmetic problems 
in the sense of II §1, but with A restricted to decidable relations they 
provide provide an explicit scheme for defining number theoretic functions 
such that 

If p is a derivation (in the non-constructive system) of 

3mA(n,m), they provide tt defined by means of the scheme 

P 

such that VnA(n, tt n). 

P 

Of course, once again the mere validity of the rules considered 
(when applied to arithmetic) is sufficient to ensure the existence of 
a program quite independently of any hypothetical proof p of 

3mA (n,m), namely, 

Compute A ( n, 0 ) , A(n,l), ... until you find an m n such 
that A(n,m ) holds. 

If 3mA(n,m) is (seen to be) true (by non-constructive means) the program 
terminates (or: is seen, by the same means, to do so). 

In view of the irrelevance to computer science of the metamathematical 
methods used, only a detailed study can decide whether the program supplied 
^ is more efficient than n^. (it is tempting to say here that one 

surely knows 'more' if one knows a proof p than if one merely knows the 
truth of 3mA(n,m); sure, but is this additional knowledge computationally 
relevant ? ) 

Remark . In terms of II §1, the justification of the program rr 

P 

requires numerical analysis. Suppose is the functional property 

used for the defining equations of tt ; then we have to have shown: 

P 

§ p (f) A(n,fn) . 

In contrast, the program ti^ requires no numerical analysis. 

(c) It is well known that for logically more complicated relations 
A(n,m), of the form 



(B primitive recursive), Vn3mA may be non- constructively provable., 
but there is simply no recursive function f at all which satisfies; 
VnA.(n, fn), In this case, ’consistency’ proofs for the non-constructive 
principles considered, may be used to provide constructive interpretat ions 
discussed at length in the papers cited in footnote l£ above. 

In general the value of these interpretations is purely logical. 
Specifically, and this is in sharp contrast to (b) above, for logically 
complicated A, the non - constructive meaning of VnSmA. may be (mathe- 
matically) interesting — bien entendu: to the non-constructive mathema- 

tician who understands this meaning! — but the constructive interpretation 
(of VnHmA) is of no interest --to anybody. So the principal problem 
here is to look for those cases which are interesting. 

Exception (from the Digression on pp 135-136 of the paper cited 
in footnote 2 of the Introduction), Little has to be added to Herbrand’s 

constructive interpretation of classical predicate calculus to convert 
. 1 Q 

Roth’s non-constructive proof of the well-known Thue-Siegel-Roth theorem 

TO 

into the refinement by Davenport -Roth, 7 This refinement was of interest 
inasmuch as its authors decided to devote a separate paper to it, 

2, Programming translators ; the present evidence, (a) There is 
no shadow of doubt of the usefulness of (knowing) consistency proofs. 
People working in number theory , quite consciously and explicitly, wanted 
to know bounds for existential, theorems proved by non-constructive means 
and, as a matter of historical fact, got lost when trying to obtain these 
bounds without theoretical knowledge of consistency proofs: the(ir) 

light of nature was not enough. Without having to apply the theoretical 
knowledge in detail, just having the general principles in mind, made 
it easy, in accordance with footnote 8 of Note 1, to obtain the desired 
bounds , But this does not yet constitute a reason for actually program- 
ming a translator] quite trivially, inasmuch as general knowledge was 
sufficient (for the bounds above) there is no need to do more about it 
unless one has new, ambitious tasks in mind! 

(b) It seems plausible that, as far as applications to computer 
science are concerned, the g eneral ideas of consistency proofs but not 
necessaril y the specific schemata of functions (leading to the programs 
n in §lb) are usef ul. Quite generally, the currently open problems 

ir 



really concern the details of the specific schemata, since the theoretical 
possitnl ity of constructivizing the hulk of mathematical practice has been 

established. Neglect of this fact has led people to rehash, at length, 

. . . 20 
dead issues. 

(c) The general conflict between logical and computational purposes 
(which we are talking about) can also be put as follows. Consistency 
proofs qua logical contribution tell us the nature of the problems in- 
volved in constructivization, in other words, what is, generally, pos - 
sible . It is not reasonable to suppose that the same piece of work 
will often be useful for actual understanding of particular problems. 

Specifically, to take one of the non- constructive proofs considered 
in the papers cited in footnote l6, knowledge of consistency proofs 
allowed one to see (the theoretically interesting fact) that without 
new ideas one obtained a bound 

2 8 

( 3 n < 2 2 )[rr(n) > li(n)] 

from Littlewood's non- constructive proof of 

3 n[n(n) > li(n)] 

where n(n) denotes the number of primes < n and li the logarithmic 
integral. But we now know (the practically more interesting fact) that 
by judicious use of new ideas and a fast computer one has 

( 3 n < (I.65) ‘lO 11 ^ ) [rr(n) - li(n)] . 21 

In the last analysis the reader will simply have to decide for himself, 
if or to what extent the theoretical knowledge helps him in his practice. 

3 ° Speculation on systematic uses of fast computers . As already 
stressed s-t the beginning of §2, there is no doubt about the possibility 
of intelligent ad hoc use of computers in extracting bounds from non- 
constructive proofs; for example, in the paper cited in footnote 21. 

But it is more difficult to formulate good general principles for such 
uses; or, put differently, it is difficult to apply to the present topic 
of translations (from non- constructive proofs to programs) the well-known 
general criteria on fruitful uses of computers. 
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(a) Principle of the middle - distance . I suppose the most familiar 
criterion is this (which, as pointed out at the end of Note 1, is not 
satisfied hy so-called automatic theorem proving). We have available 3 
conditions: (i) a formal analysis of a problem, in our case of extracting 

bounds from formal derivations in non- constructive systems; (ii) the 
analysis is not so s imple that we can apply it ’efficiently ourselves; 

(iii) the analysis is not so complicated that it cannot be used by (existing) 
computers either. 

To make progress we must look at the details of consistency proofs 
and the preparation needed in their application. The first point that 
helps is that we do not need a ’fully formalized' argument. One soon 
learns to separate irrelevant inferences and concentrates on critical 
ones. 22 The bounds obtained by use of a consistency proof depend (only) 
on the syntactic properties of the formulae appearing in these critical 
inferences. What can the computer do that we can’t or won't do? 

Speaking fran my (limited) personal experience a human computer soon 
gets bored trying to determine the syntactic complexity of the relevant 
formulae , and then makes quite rough estimates. The loss of computational 
efficiency is hidden because we use non - numerical terms in presenting the 
solution (cf. I §la). Thus in §2c we have 

2 8 

2 2 and (1.65) 10 1165 ; 

size, not (human) intelligibility , makes a marked distinction between 
these two terms. 

Suggestion . Perhaps there are occasions where a computer can produce 

a significantly lower bound without any new ideas, but as follows. We 

take the explicit definitions in an informal proofs we take the critical 

inferences (expressed of course by use of those explicit definitions) 

and simply let the computer work out the syntactic complexity of the 
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formulae obtained after eliminating the explicit definitions. 

(b) Developing the suggestion above, one could look for a very 
special kind of 1 automatic ' theorem proving , namely reductions of the 
syntactic complexity of the critical formulae (of course, reductions 
by means of non- critical inferences). 



This particular proposal is related to the general aim of using com- 
puters to fill in ' gap s * in elementary informal proofs . But even if, per- 
haps for the reasons given at the beginning of I §3c, this general aim 
has no feasible mechanical solution, the narrower problem of reducing 
syntactic complexity may do: it certainly has a more mechanical look . 

Also this problem does not involve any (artificial) reduction of the 
language used (which is the ’logical' device that, in these notes, is 
held responsible for inefficiency). 

Warning . All I can hope to have done here is to have made a case 
for studying problems which , for the widely accepted doctrinaire views 
described in footnote 18, are underestimated . There can, I think, be 
no true progress until we have found a specific problem, where we really 
want to k now the bounds and therefore can judge whether some given solu- 
tion is satisfactory. Afterwards we can build on the solution. 



IV . Experiments with Computers on the Complexity 
of Non - numerjcal Computations 

In Note I §3c, in connection with search procedures for proofs, that 
is, ’automatic theorem proving', the role of extending the language of 
predicate calculus (in human proofs of logical theorems) was discussed. 
The formulation of this role in precise mathematical terms is quite ob- 
vious. Moreover, given a particular set of deduction rules the problem 
of determining bounds for the efficiency of search procedures (average 
length of searches) is of course mathematically well defined. But all 
this is irrelevant, on the practical philosophy guiding these notes, 
since the general problem is too complicated combinatorially and therefore 
not likely to be (practically) rewarding. 

Rather, we should like to make use of the experience we all have 
of mathematical proofs to pick out particular cases which have a chance 
_of being typical . This is all the more important in the present context 
since there is a genuine possibility of using computers to help study 
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such a particular case, but none of using them directly for the general 
mathematical problem above. The reader should note that this proposal, 
of using computers on such typical particular cases, is itself a good 
example of the ad hoc uses of computers described at the beginning of 
III §5 (so-called 'man-machine interaction* *): searching through search 

procedures would be hopeless even for computers; however, for some par- 
ticular examples and search procedures, analyzing the- length of the search 

seems hopeless for a human computer (even if he is allowed to use all his 
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mathematical ingenuity ' ); but by the very nature of the problem, a com- 
puter can, always, be used to decide whether the particular procedure is 
practical for this computer to solve a particular problem: just set the 

computer going and let it run for the time you have available 2 

The basic question is of course: how good is our judgment of which 
cases are typical ? Since a fair amount of computer time (where time is 
money, and not merely ennui ) is needed for the kind of experiments I have 
in mind, let me begin by expanding the argument in I §3c for giving up the 

’logical* point of view. But the discussion is not needed for §§2-3. 

_ , 26 

1. Some consequences of the chase after logical completeness . 

The kind of completeness meant concerns not only completeness (of proof 
procedures) w.r.t. validity, but also so-called functional completeness 
(of the language used) . 

(a) In connection with predicate calculus, if logical selection 
criteria are to be used at all, the classification according to prefix 
complexity is no doubt as natural as any. For this classification essen- 

tially only (negative) undecidability results are available. 

More importantly, for the most outstanding decision methods so far 
discovered (for various classes of fields ) , the subclass of formulae 
considered, namely, 

(*) A B 

for fixed A and arbitrary B, is quite unnatural from a purely syntactic 
or logical view: the choice of the particular A is not explained in 
syntactic 'terms. 

Conversely, at least at present, if we take such a known decision 
method and ask for a more general class (A) of formulae (with A e (A) ) 



to which the method applies, no syntactically natural definition of (A) 
suggests itself. In the words of Wang's paper, cited in footnote 26, 
p. 102: we have here a powerful (decision) method applied to the re- 

stricted 'range' of formulae (*). But we don't really know what to do 
with the method within the general framework of logical complexity (how 
to 'explore' it, loc . cit., p. 102, 1. ll). Incidentally, the same situ- 
ation arises with more advanced mathematical results when they are for- 
mulated in some reductive vocabulary like that of axiomatic set theory. 

We have here a typical example of the frustration produced when 
one wants to apply the much vaunted dialectical method: itjaS all very 

well to say we should build on previous knowledge (= synthesizing thesis 
and antithesis); but which general framework (for a synthesis) is valid? 

(b) In connection with (partial) recursive functions we have a sim- 
ilar situation to the reduction classes in (a). As shown by various 
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'axiomatic' recursion theories or combinators: provided we have a 

few 'simple' basic functions and some kind of composition, all partial 
recursive functions can be defined and hence, once again, we have a 
host of (recursive) undecidability results. 

If we stay closer to computations, not the partial recursive func- 
tions, but rudimentary functions used to code the sequences of states 
of a Turing machine (or, equivalently, used to enumerate r.e. sets) are 
fundamental; the partial recursive functions are defined from them as 
described. (This example was already used in the Technical remark at 
the end of I §2a). While of course equations between closed rudimentary 
terms are, those between open ones' are not, in general, decidable; cf. 
the Remark in II §2. 

(c) Granted (a) and (b), a study of logically 'complete' languages 
(for the whole of predicate logic, resp. for all partial recursive func- 
tions) would still make practical sense if there were at least a fair 
number of significant cases where results about the whole, undecidable, 
class specialize to practical computation procedures in some practical 
subclass ; in other words, if the 'logically complete' theory were a good 
practical theory. 

I know from experience in proof theory that, at least there, one 
has to make a fresh start; as was mentioned earlier, proof theory begins 
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where recursion theory ends; cf. specific examples in §2b below. As to 

2o 

computation, for example, Rabin's useful decision method for trees 
does not seem to be a special case of a general result (perhaps on de- 
finability- -of course not on decidability) for, say, the whole second 
order predicate calculus. 

Discussion. By footnote 25, the general issue is far too inter- 
esting simply to adopt some point of view (for example, of the present 
notes) as a working hypothesis . One wants to test it. The difficulty 
in testing is of course this: whatever view one adopts one is going to 

get some 'results’; and if the view is coherent one will get mathematically 
satisfactory results, even if the view itself is mistaken. 

I suspect that the present issue is closely connected with the so- 
called 'prejudice' of mathematicians against logic. Since most of those 
mathematicians do not know technical logic their opinion is not based on 
the actual technical level or mathematical quality of the methods used in 
logic. What they do know is the ordinary meaning of 'logic' as the science 
of reasoning or of the principles of reasoning; in other words, that the 
subject of logic (applied to mathematics) is concerned with possibilities 
of proof. And, in their inarticulate way, mathematicians want to say 
that the kind of general knowledge of such possibilities provided by 
logic, does not help them with actual understanding of a given proof; 
cf. also III §2c. 

The only part of the mechanistic view mentioned in footnote 2.6 that 
I am using in these notes^ is this: 

Human intelligibility is a qualitative indication of mechanical 
feasibility. 

As a kind of corollary: 

A proof which surprises us will be difficult to find by a 
general mechanical method. 

We shall consider two measures of difficulty in §§2, 5* 

2. First experiment i The intention is to find a problem, which is 
formulated in first order language and is of undisputed mathematical 
interest (and hence of feasible length!), but has no proof of feasible 
length in the language of predicate calculus. 
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In other words , though some proof in predicate calculus exist s, such 
a proof is not only difficult to find , hut difficult to write down (even 
if found). Consider the proposition 



There are no skew fields or division algebras over the reals 

of dimension n except for n = 1 , 2 , 4, 8 (real and complex 
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numbers, quaternions and Cayley numbers resp.). 



For any fixed n, there is of course a formula in the first order language 

of real closed fields which expresses the existence of such an algebra of 

dimension n by means of an 3V formula, say Sc^fx^yD , namely, the 

k. ^ 

existence of elements (real numbers) a . . (l < i,J.,k < n) such that the 
composition law or ’multiplication table' 



( Xl ,...,x n ) * (y-L> * “>y n ) = (££qo .x ± y , . . .,ZEor“ x ± y ) 



satisfies the axioms for a division algebra (of course for all real 
numbers x and y) . 

A statement of this form is decided by the (first order) axioms 

for real closed fields. Therefore for each n ^ 1, 2, 1, 8 there 

exists some derivation of — i V3? T5? D from those axioms. 

n 

CONJECTURE . There is an n, say n = 6k or n = 256 , for which 
the formula —1 Vx? Vj? can be stored in the memory of a moderately 
priced canputer, but the shortest first order deduction cannot be carried 
out in a week on the fastest available computer. 



The assumption about feasib ility here is that at most one week's computer 
time on the fastest computer is available to the experimenter. 

Evidently, in principle, the problem is purely mathematical once 
the intended deduction rules for predicate calculus (or, more precisely, 
not for logical validity but for consequence from axioms for real closed 
fields) are given. I assume that this mathematical problem is too diffi- 
cult. The experimenter should reflect, perhaps guided by the topological 
proofs cited in footnote 29 ., on the most promising strategies and then 
let a computer work them out. Here are some comments for orientation. 

(a) The general reason for choosing this problem is stated quite 
convincingly by Wang (cf. footnote 26, p. 107,. second paragraph). The 
topological proofs were found to be surprising. Moreover, the theorem 



in question had been conjectured a long time age; so it was the proof,, 
not the result which was surprising. Hence it seems not unreasonable' to 
suppose that some intrinsic properties of possible proofs--and not only 
of the search for proof s--constituted an obstacle to its discovery; cf . 
also the Remark at the end of this Note. (The particular conjecture is 
problematic, just because the general reason is quite commonplace.) 

The present issue should be distinguished from a superficially 
similar problem which is definitely interesting for computer science 
but of a different character, namely., the c omputati onal analysis of the 
various decision methods for the theory of real closed fields . To dis- 
cuss this matter we need a distinction . 

(b) In its ordinary sense a decision method is given by a function 
S from (closed) formulae A (of the theory) to {T,iL}, where 

8(A) = T if A holds , 8(A) = I if A does not hold; 

or,, equivalently, in the case of a complete theory,, where 

8(a) = T if A is derivable,, 5(A) = 1 if — i A is derivable. 

Actually, constructive proofs of decision methods, for example, by quan- 

F 

tifier elimination, yield more, namely, a function 8 from formulae to 
formal deductions in a system F such that (for example, in the case of 
complete theories) 

F 

8 (A) is a formal derivation in F of A if A is derivable, 

F 

8 (A) is a formal derivation in F of — i A if — i A is derivable. 

F 

Clearly the CONJECTURE would be refuted if we had a practical 8 for 
the theory of real closed fields (where F is the formal first order 
theory) . Equally clearly, the topological proof provides a splendid 8 
for the class of formulae 3 c? VP 5 V y* for n = 1, 2, ... I (This is 
the .’sophisticated example’ promised at the end of II §1.) 

From non- constructive proofs establishing the decidability by means 
of a function 8 we can of course also derive an explicit S* 3 ^ ..where, 
however, 3? contains also the principles used in the metamathematical 
proof of decidability. 
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8*( A ) consists in evaluating 5(A) and then attaching the 
metamathematical proof of the properties of 5. 

F 

The reader -will recognize the parallel between the relation of 6 to 

5^ on •'•he one hand and the relation of numerical to non- numerical but 

numerical- valued terms (in I §2a or III §3a) on the other. The main 

F 3? 

difference is that the values of 6 (A), S (A) are proofs and not 
numbers . 

An even more brutal use of non-constructive proofs of decidability 
(which need not even provide an explicit 5) is this: one defines the 

recursive function 5^ ('D' for mere decidability) 

5^(A) is the first derivation d (in some co-order of the 
formal derivations of the given system) which ends up with 
either A or with — i A. 

S' 0 is recursive by (the mere fact of) decidability and recursive enu- 
merability of the theorems of any formal system. There is no apparent 

way of refining the brutal definition S' 0 to get a practical 6, let 
F 

alonp 5 . The reader will have recognized here a particular instance 

of the limitations of recursion theory discussed in §1c above. (He would 

be amazed to know how often the simple facts above are ignored in the 

literature , with hilarious results.) 

(c) It goes without saying that (as is familiar from all sciences 

which involve both theory and experimentation) it cannot be 1 expected that 
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all details of the experiment proposed are perfect! A skillful computer 
scientist may think of a more promising example to work on than the theorem 
about division algebras. But it is possible to analyze in advance at least 
in a general way what we can expect to learn from this kind of exper iment . 

If the conjecture is refuted (for some n which 'barely* misses 
being a solution) , one would simply have an unexpected success of automatic 
theorem proving in its current sense. Also, I should expect from this a 
contribution to algebra: a mathematician reflecting on this hypothetical 

piece of first order algebra may discover in it some general features of 
mathematical interest. 



If the conjecture is established, we have only evidence against the 
(whole) current trend in non- numerical computation, not against the pos - 
sibility of using computers . 

We have to look for relatively few additional notions about the 
real numbers (enrich the field structure a 'little') in order 
to shorten relatively many proofs considerably. And we ict 
to find a not negligible area of problems which are of interest, 
and have computer- solutions by use of these additional notions 
(problems which do not have computer- solutions without them nor 
humanly performable solutions with them). 

To remove a quite unjustified air of unreality from this task, it should 
be observed that it is analogous to the task which the ' abstract ' mathe - 
matician sets himself (except of course that the reference to 'computer- 
solutions' is to be dropped); 'humanly performable' means: comprehensible. 

The mathematician’s task is not finished even when there is a practical 
decision method for all formulae of a language! He still wants to find 
infinite or even large finite classes of formulae for which he can tell 
us the resnT t of applying the method, in short, he really wants to solve 
problems . 

Inasmuch as the organization of a ccmputer is different from our way 
of thinking, the computer scientist cannot expect to use exactly the same 
solutions as the mathematician. But one would expect the mathematician's 
'unsystematic' work to provide a better general guide than the systematic 
parts of logic. On this score proof theory seems to stand a better chance 
of being useful than say model theory or recursion theory just because of — 
what to many logicians is--its principal 'defect': it studies specific 

systems, specific processes derived from an examination of our "intended 
meanings, and has to search for principles of choice (which even after 
they are found may be less convincing than the choices themselves). 

3. Second experiment : Here the intention is to find a theorem 

(bien entendu, again of undisputed interest) which we know to have relatively 
short proofs in a given system; but no reasonable universal search procedure 
could be expected to find such proofs in a feasible number of steps . 




33 

37 



Consider the arithmetic propositions: 

2 2 

( i ) n = 0 V — in = 2m 

i.e., the irrationality of the square root of 2, and 

(ii) n ®m °p = 0 V — i n^ + m^ = p^ for q = 3j 4, • • • > 

i.e., instances of Fermat's conjecture. 

Both (i) and (ii) are -written in the language of the ring of integers 
(that is,, + and X only). Certainly (i) has a relatively short proof 
in the first order theory of the ring of integers, including induction. 

And (ii) has such a proof, for instance, for q = 3 or q = 4. 

The known proofs of (i) and of (ii) with q = were certainly 

felt to he surprising . One striking feature in both cases is that, as 
ordinarily formulated, the proofs use concepts which do not occur in 
the statements of the theorems . More formally, they use concepts which 
cannot be defined in the language of rings without the use of logical 
symbols, for example, in (i) one uses divisib ility or prime factorization , 
in (ii) for q = 3 one uses Legendre 1 s symbol . These proofs can be trans- 
lated into the first order language of rings by using, throughout, explicit 
definitions of the new concepts (and relatively simple proofs of their 

’defining equations’ when the new symbols are replaced by the definitions). 
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It is a mathematical fact that the theorems mentioned cannot be 
proved in the theory of rings with induction, but without the use of 
logically complicated formulae. Put differently, the selection of those 
auxiliary concepts and of their definitions in the first order language 
of rings is the central problem. 

My impression (or, as people nowadays like to say, .’intuition’) 
is that tne selection depends, practically speaking, on understanding 
the intended arithmetic meaning of (i) and (ii). A possible computational 
effect could be that universal procedures (for predicate logic or perhaps 
even ring theory) would not find proofs quickly . 

Evidently the first step would be to take an existing procedure; 
or rather choose among existing universal procedures the one that strikes 
the computer scientist as best suited to this problem. Perhaps someday 
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one 



could even solve the mathematical problem for all universal procedures 
(satisfying some uniformity conditions which exclude building the known 
proofs of (i) or (ii) into the first few steps of the procedure); for some 
q in (ii) the search is inordinately long. 

The general points made in §2 apply also here mutatis mutandis . 

Remark. In line with footnote 25 (and Wang's paper cited in footnote 
2 6 ) it would seem to me quite interesting to analyze striking specific 
facts in the history of mathematics in terms of complexity of non- numerical 
computation. .For example--as a foil to the conjecture in §2-- it was proved 
a„long time ago that the only associative division algebras over the reals 
have dimensions 1 , 2 , or 4: 

QUESTION; Is there a relatively short first order proof of the fact 
that there is no such algebra of dimension 64 or 256 ? 



V. Remarks on R elevant Proof - theoretical Literature 

Granted the basic phi- osophy going through these notes, namely, the 
stress on the difference between logical and computational significance, 
the following corollary is plausible. 

The logical highlights of proof theory, which are of course the 
best-known parts of proof theory, are not likely to be of direct interest 
to the computer scientist. And, in particular, negative results are 
something in the background, telling him what not to do or to expect. 

For the same reason the computer scientist, especially if he is 
interested in non- numerical computing, may find useful information in the 
neglected proof theoretical literature * neglected 1 because, from a 
logical point of view, it was marginal. The kind of thing I have in mind 
is some new particularly elegant formalization or a particularly direct 
treatment of some problems which, as far as logical interest was concerned, 
had really been solved completely. There is of course no guarantee that 
elegance or directness (for the human reader) will always have computational 
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WB: The neglect 
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value but the possibility is worth keeping m mind, 
of this kind of work X have in mind is not accidental: without ihe addi- 

tional computational analysis,, the work is useless. 

1. Propositional operators : — 1 , A, V, -**♦-*• Logically, most 
of these are unemployed , at least for the usual truth functional inter- 
pretation since all of them can be defined by superposition from, say 
(-!, a). Similarly, the propositional constants T and 1 can be de- 
fined since, for variable p, p A -i p = L Lor logical metamathematical 
arguments it is convenient to use only ( — a) in order not to have too 
many cases to consider* But, for example, as long as the operators oc- 
curring in a formula determine the rules to be applied 'in some non- numerical 
computation it seems plausible that a compromise is most efficient, where 
one uses not only — \ and A, nor, of course, a separate symbol for every 
truth function The following remarks may provide some perspective. 

(a) Logically sophisticated readers seeing novel, more elegant for- 
malizations tried to use them to get new logically significant results, 
for example , by applying the new work to intuitionistic systems which 
(are known to have logical interest but) do not allow explicit definition 
of the other propositional operations from (— i, A) . This applies also 
to §2 below. 

(b) The step (a) simplified the analysis by the-ma thematically- very 
popular device of using a purely qualitative (indefinability) criterion 
so that there is no need for closer quant itat ive analysis. In contrast, 
the proposed computational use of novel formalizations needs at least some 
assumptions about a correct measure of computational complexity. To judge 
significantly between two given formalizations it will not be necessary to 
find a particular measure, but only a few evident properties of a correct 
measure . 

(c) Logicians will of course try to exploit the last observation in 

(b) above; see also the remark, at the end of this note. But it is certainly 
possible that good knowledge of computer ’hardware 1 may help one find an 
explicit measure of complexity, and thus replace the judgment needed to 
see what is significant or evident about such measures. 
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(d) Practically speaking, the reduction of our problem to the kind 
of judgment just mentioned constitutes progress: probably more people 

(experienced in computer science) have such judgment than the taste 
needed to recognize elegance in the proof theoretic literature. (It 
is quite unnecessary to claim that matters of taste are not objective; 
it is enough if people lack taste; just as it is of little help to blind 
people that differences in color are objective: what they need is an 

extensionally equivalent criterion which they can use, such as those 
famous pointer-coincidences. Only the person who establishes the 
equivalence must be able to see, and the same applies mutatis mutandis 
to our problems about significance of computational measures.) 

2. Prenex normal forms. Here again there is no doubt that for 
(classical) logic, for example, in completeness proofs or in the state- 
ment of such interpretations as provided by Herbrand's theorem (cf. the 
end of III §l) it is rewarding to exploit the existence of prenex normal 
forms. But we have already seen the computational absurdity of the 
classification by prefix complexity in IV §la. 

More importantly, if one is interested in the formal deductions 
themselves (not only easily comprehensible interpretations of the kind 
needed for Note III), it is morally certain that it is better to use 
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formulations in systems of natural deduction and normalization pro- 
cedures; these are not significantly simpler for prenex. formulae ; In 
contrast to Herbrand's treatment they also analyze quantifier free but 
propositionally complex formulae. The moral certainty will become mathe- 
matical if a correct measure of complexity of deductions and bounds for 
the complexity (of the particular deductions involved) are available. 

J. Equality . It is one of the more memorable facts of elementary 
logic that the theory of predicate logic when = has the intended meaning 
is reducible to ordinary predicate logic (in contrast, e.g., to the cc^e 
where we have a binary relation symbol < with intended meaning: a < b 

if and only if a and b are natural numbers and a is less than b) . 

One simply takes all relation symbols R. and function symbols f 

j J 

occurring in the formula F to be treated and considers the implication 
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(*) Vx Vx ' {/Ax. = x') -> /A[(R. R.') A (f . = f')]) 



where "x is a sequence of variables containing the arguments of all the 

R. and f. and R (, F( are obtained by substituting x.' for x. in 
J J J J 11 

R . , resp. f .. (No two symbols, R or f, have any argument in common.) 

J J 35 . 

But as any writer on proof procedures knows, derivations of the 

implication (*) have a quite different structure in detail from, say, 
natural deductions of F using relevant equality rules . (I cannot re- 
call exact references, but I seem to remember material in Japanese 
journals and in a letter from K. Schutte. ) 

4. Axioms and rules . The particular case of equality in §3 is 
distinguished by the fact that, for a given F, a single (equality) 
hypothesis is added, which, moreover, is determined by F itself. In 
the case of the induction schema, 

(**) Yx[{a(0,x) A Vn[A(n,x) -» A(n + l,x)]] -» VnA(n,x)] 



we have also a reduction to predicate logic; it needs a single premise 
if we use the schema only for formulae A of bounded complexity; in- 
stead of the equality axiom in (*) of §3,? we use (**) as an hypothesis 
on F. 

But, as any up-to-date account of the matter shows, we cannot 
deduce significant results for arithmetic frcm such results as Herbrand’s 
theorem; at best we can hope to generalize uhe ideas involved in the proof 
of the theorem, and apply them to the rule: 
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Derive VnA(n) from A(0) and Vn[A(n) — > A(n + l)]' . 



5. Computation diagrams for various classes of functions . In view 
of the connections between computations and deductions discussed at length 
in Notes 1 and 2, it is clear that the proof theoretic literature must 
also contain several computation diagrams or schemata which define the 
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same class of functions but have quite different computational properties. 
However, I am not competent to give a detailed bibliography. 

CONJECTURE. Probably a good deal of information which is useful to 
the computer scientist is contained in the details of work by people who 
are best known for the logically important results they have obtained 
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■while the elegance of their mathematical ideas may or may not he recog- 
nized; as examples of the former we have the family J . and R. M. Robinson 
or Schiitte; as examples of the latter, Kleene and some Japanese authors. 

It must be remembered that mathematical elegance (which is relevant 
to computational applications) need not be apparent from the look of the 
printed page, let alone from the grammar of the introduction or the general 
literary form--and therefore it is not easy for us to judge at a glance. 
This is on-y one further addition to the many examples in these notes of 
the differences in detail between human and mechanical requirements. 

Remark . As far as I can see, a rather simpleminded idea of choosing 
between formalizations, which I have pursued for some years, has not yet 
been refuted : 

To consider infinitary languages, where of course differences 
are very much magnified (the ratio of CDJCD is 'bigger' than 
the ratio 2 : 2 !), and to hope that obvious ordinal measures 
in the infinitary case will be a reliable guide to the subtle 
measures needed in the ordinary finite case. 

Cf. the paper cited in footnote 36, top of p. 330 (and, for yet another 
direction, App. VIII on pp. 383-38^-). 
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Footnotes 



3 

ERIC 



This research was supported by National Science Foundation Grant 
NSFGJ- 443X2. 

2 

Some of the material in these notes appeared in: Hilbert's programme 

and the search for automatic proof procedures. Springer Lecture Notes 125 
(1970) [pp. 128-146, reviewed Zbl. 206 (l97l) 277-278], which are the pro- 
ceedings of a conference held in Versailles in December 1968 (on automatic 
demonstration) . The present version is not only better organized and more 
articulate but, especially in Note 2, makes essential use of recent mate- 
rial published in: Second Scand. Logic Symp., ed. J. E. Fenstad, Amsterdam, 

1971. 

■^Mathematicians have studied only relatively recently so-called 
non-extensional properties (of rules) which distinguish between two 
rules even if both assign the same value to each particular argument. 

For an example from arithmetic, consider the following two rules which 
determine quite different computation procedures. Letting mean: 
is replaced by, the first rule says: n n 0. The second rule says: 

n i-> n - n with two 'subroutines' determined by the familiar rules for 
the predecessor (pred) and subtraction (f, as ab'/ve), that is, pred 0 i-> 0 
and pred (m + l) l-» m; m - 0 i-s m, and m - (p + l) h> pred (m - p). 

k 

The business about computation being an art supposes of course that 
there are no aesthetic laws. Actually, I believe, quite often we have to 
do with an illiterate expression of a sensible objection, namely, when 
quite unimaginative classes of rules are preferred for no other reason 
than that they are precisely defined (say, primitive recursive computation 
rules). A vague idea which is fairly close to good sense is often much 
more useful, u hough--by the very meaning of the terms -- wc should not be 
able to give (explicit) reasons for this fact. 

5 

At the risk of sounding arrogant J should like to add that, just 
because of this difficulty, not only particularly gifted, but also quite 
weak minds are attracted to these problems, the latter because it is more 
difficult to establish the inadequacy of their proposed solutions. 'What- 
ever my motives in saying this, I believe the remark is practically important, 
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for c omputer science. Otherwise one is tempted to assume that, for example, 
the whole subject of automatic theorem proving is hopeless Just because the 
quite massive existing literature contains so little significant work. 

° Old- fashioned experimental genetics and pseudo creative recursion 
theory have a similar jargon hut like to use long words. 

'This metamathematical meaning is not what we are taught in university 
mathematics when the integers and (cardinal) addition are defined set 
theoretically. There we prove, using our knowledge of set theoretic 
notions, that the assertion VxVy(x + 0 = x & x+:sy = s(x + y)) is true 
for the set theoretic meaning. In a careful course it is then explained 
why, for numerical terms n and m, n = m is true for the set theoretic 
meaning if and only if n and m have the same formal value (complete- 
ness of the rules of addition; see para. 2 below). 

®It is certainly true that in some highly developed subjects (electric 
networks) theory actually predicts experimental results; inrsuch cases a 
developed formal theory is always useful. But theoretical or 'idealized' 
notions can also be useful in more subtle areas by drawing attention to 
general features or, as one says, by providing a 'point of view' . This 
can be achieved either by means of a mathematical formulation or by an 
instructive example. 

^For further support, see J . T. Kearns, JSL 34 (19^9) 5^1-575 and 
(the supplementary) Part II of the dissertation by H. P. Barendregt, 
Utrecht, 1971. There it is shown how Turing machine programs tt (and 
other computation diagrams) map into combinatory terms t in the sense 
that the sequence of states determined by tt corresponds to the sequence 
of terms appearing in the reduction of the term t . 

the present context it would be pointless to 'identify' a formal 
system with its set of theorems, that is, to forget everything about it 
except the set of theorems: one wouldn't be making any deductions at all! 

One may still 'identify', say, the rules for forming wff with the set of 
wff as long as, quite realistically, it is easy to decide whether or not 
an expression is a wff. 
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^"In §la of: A survey of proof theory II, Second Scand, Logic 

Symposium, ed. J. E. Fenstad, Amsterdam (1971) 109-17C9 I discuss some 
Kleinarbeit which is required here. In the same volume there is also 
an excellent account which 'accentuates the positive 1 , by Prawitz, partic- 
ularly pp. 282- 2Q3 on a connection between derivations and terms. 

12 

As always, maximizing an efficiency ratio does not consist in 
taking some given class of cases (say all formulae of predicate logic 
or all diophantine equations) and looking for a most effective procedure 
of handling them all : even if such a procedure exists it may be hope- 

lessly ineffective. The problem is to discover a subclass which is (i) 
still useful;, but which (ii) admits a much more effective procedure. For 
this reason ’logically' complete languages are rarely useful when efficiency 
is the principal issue. 

15 

k3ee H. S. Vandiver, Fermat's last theorem, Amer. Math. Monthly 60 
(1953) 164-167 and the literature referred to there. 

14 

The reader should, of course, make use of the knowledge he happens 
to have (for an illustration, it doesn’t make sense to learn a new ex- 
position even if it is much more elegant, provided a familiar one conveys 
the same idea). A fairly adequate introduction is on pp. 225-227 of 
Shoenf ield ’ s standard text Math emat i c al Logic , Addis on- Wesley, 1967” 

For mors detail see: L. E. Sanchis, Notre Dame J. Formal Logic 8 (1967) 

161-174, another is W. A. Howard, pp. 443-458 in: Intuitionism and proof 

theory, Amsterdam, 1970. A word of warning: the fact that the meta - 

mathematical methods used by Sanchis in the analysis of computability are 
less elementary than Howard's is totally irrelevant for computational 
applications, just as--at the end of §1 above -- any proof of Fermat's 
conjecture, however non - constructive , makes the difference between the 
first, useless, (primitive) recursive programmation and the second which 
appeals to (hypothetical) numerical analysis. To return to the two papers 
above: it is more significant computationally that Sanchis establishes 

strong computability for a greater variety of reduction rules than are 
considered by Howard. (Computation is closer to genuine mathematics than 
to foundations.) See also the papers cited in footnote 11 of Note 1. 
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